LiveActive security incident?Get immediate response
CVE Record

CVE-2024-11831: Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

MediumCVSS 5.4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This is a cross-site scripting flaw in serialize-javascript. If an application sends unsafe serialized data to a browser, attacker-controlled JavaScript-like content could execute in a user’s session. Business impact is mainly user trust, session exposure, and data integrity, not server takeover.

Executive priority

Treat as a medium-priority application security issue. Accelerate remediation for customer-facing sites and admin consoles, especially where lower-privileged users can create content viewed by others. No source evidence indicates active exploitation, but XSS can still create meaningful account and data exposure.

Technical view

CVE-2024-11831 is CWE-79 in serialize-javascript, reported against version 6.0 and bundled in several Red Hat products. The flaw involves insufficient sanitization of inputs such as regex or JavaScript object types before browser use. CVSS 3.1 is 5.4: network reachable, low complexity, low privileges, user interaction required, changed scope.

Likely exposure

Exposure is most likely in web applications or management consoles that use serialize-javascript and send serialized, attacker-influenced data to clients. The bundle lists serialize-javascript 6.0 and specific Red Hat ACS, Ceph, RHEL dotnet8.0, and ODF package builds as affected.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. Exploitation requires a path where a low-privileged attacker can influence serialized content and a user later opens a browser view that deserializes or executes it.

Researcher notes

Key uncertainty is fix detail: the bundle lists affected versions and Red Hat errata, but not exact fixed serialize-javascript or packaged versions. Validate reachability by data flow, not package presence alone, because risk depends on serialized attacker-controlled values reaching browser execution contexts.

Mitigation direction

  • Check upstream serialize-javascript and Red Hat advisories for fixed versions.
  • Prioritize updates for internet-facing or shared administrative web consoles.
  • Identify and reduce browser exposure of attacker-controlled serialized data.
  • Use safe output encoding and avoid executing serialized content in clients.
  • Apply relevant Red Hat errata where affected packaged products are deployed.

Validation and detection

  • Inventory dependencies for serialize-javascript version 6.0 or vulnerable packaged builds.
  • Search applications for server-generated serialized JavaScript embedded in browser pages.
  • Map affected Red Hat package names to deployed ACS, Ceph, RHEL, and ODF systems.
  • Confirm whether serialized fields can be influenced by low-privileged users.
  • Verify remediation against vendor advisory versions, not inferred package names.
Prepared
Confidence
medium
Sources
12

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
description · low confidence lookup

Container behavior lookup

The affected technology mentions containers, so container-specific ATT&CK technique review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2024-11831 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
5.4 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
5Timeline events
1ADP providers
25Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
5.4CVSS 3.1MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N2.32.7redhat

Vulnerability scoring details

Base CVSS 3.1 score

5.4Medium
CVSS 3.1 vector shape for CVE-2024-11831Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. Source timelineredhat

    Made public.

  2. Source timelineredhat

    Reported to Red Hat.

  3. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  4. CVE publishedCVE Program

    The CVE record was published.

  5. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
Unknown vendorserialize-javascriptserialize-javascript, 6.0Listed
Red HatRed Hat Advanced Cluster Security 4.4advanced-cluster-security/rhacs-main-rhel8, 4.4.8-2affected
Red HatRed Hat Advanced Cluster Security 4.5advanced-cluster-security/rhacs-main-rhel8, 4.5.6-2affected
Red HatRed Hat Ceph Storage 7.1ceph, 2:18.2.1-381.el8cpaffected
Red HatRed Hat Ceph Storage 8.1ceph, 2:19.2.1-292.el9cpaffected
Red HatRed Hat Ceph Storage 9.0ceph, 2:20.1.0-144.el10cpaffected
Red HatRed Hat Enterprise Linux 8dotnet8.0, 0:8.0.112-1.el8_10affected
Red HatRed Hat Enterprise Linux 9dotnet8.0, 0:8.0.112-1.el9_5affected
Red HatRHODF-4.14-RHEL-9odf4/ocs-client-console-rhel9, v4.14.18-2affected
Red HatRHODF-4.14-RHEL-9odf4/odf-console-rhel9, v4.14.18-3affected
Red HatRHODF-4.14-RHEL-9odf4/odf-multicluster-console-rhel9, v4.14.18-2affected
Red HatRHODF-4.15-RHEL-9odf4/ocs-client-console-rhel9, v4.15.14-2affected
Red HatRHODF-4.15-RHEL-9odf4/odf-console-rhel9, v4.15.14-2affected
Red HatRHODF-4.15-RHEL-9odf4/odf-multicluster-console-rhel9, v4.15.14-2affected
Red HatRHODF-4.16-RHEL-9odf4/ocs-client-console-rhel9, v4.16.10-4affected
Red HatRHODF-4.16-RHEL-9odf4/odf-console-rhel9, v4.16.10-4affected
Red HatRHODF-4.16-RHEL-9odf4/odf-multicluster-console-rhel9, v4.16.10-3affected
Red HatRHODF-4.17-RHEL-9odf4/ocs-client-console-rhel9, v4.17.7-2affected
Red HatRHODF-4.17-RHEL-9odf4/odf-console-rhel9, v4.17.7-2affected
Red HatRHODF-4.17-RHEL-9odf4/odf-multicluster-console-rhel9, v4.17.7-2affected
Red HatRHODF-4.18-RHEL-9odf4/ocs-client-console-rhel9, v4.18.2-8affected
Red HatRHODF-4.18-RHEL-9odf4/odf-console-rhel9, v4.18.2-7affected
Red HatRHODF-4.18-RHEL-9odf4/odf-multicluster-console-rhel9, v4.18.2-8affected
Red HatRed Hat Ceph Storage 8rhceph/rhceph-8-rhel9, 8affected
Red HatRed Hat Ceph Storage 9.0rhceph/rhceph-9-rhel9, 1776359884affected
Red HatRed Hat OpenShift Pipelines 1.14.6openshift-pipelines/pipelines-hub-ui-rhel8, v1.14.6-1744143767affected
Red HatRed Hat OpenShift Pipelines 1.15openshift-pipelines/pipelines-console-plugin-rhel8, v1.15.3-1746939886affected
Red HatRed Hat OpenShift Pipelines 1.15openshift-pipelines/pipelines-hub-ui-rhel8, v1.15.3-1746936251affected
Red HatRed Hat OpenShift Pipelines 1.16openshift-pipelines/pipelines-console-plugin-rhel8, v1.16.4-1747983385affected
Red HatRed Hat OpenShift Pipelines 1.16openshift-pipelines/pipelines-hub-ui-rhel8, v1.16.4-1747979846affected
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.